A Hybrid Anomaly–Rule–Pattern Detection Framework for Streaming-Based Persistent Intrusion Detection

Abstract

Contemporary network systems suffer stealthy, persistent cyber-attacks such as low-rate distributed denialof-service (DDoS) attacks and slow brute force logins which can commonly elude traditional intrusion detection systems (IDS). This paper demonstrates the Hybrid Anomaly–Rule–Pattern Detection Framework for Streaming-Based Persistent Intrusion Detection to improve the system resilience against persistent threats. The model incorporates three cooperating modules: Anomaly Detection Module, which adopts unsupervised outlier methodologies (Isolation Forest, LODA and HBOS) for statistical deviation detection;Rule-Based Module that encapsulates Snort-3.0 style signatures together with behavioral heuristics of known attack classes; and finally the Pattern Recognition Module which employs hierarchical clustering with cosine similarity to link recurring temporal behaviors across sliding windows. Weighed Ensembles of multi-source alerts are fused to high-confidence Meta-Alerts in real-time. Experiments on a setof benchmarks CICIDS2017 and UNSW-NB15 show performance improvements over baseline SOAAPR, which yields Precision = 91.3%, Recall = 94.2%, F1-score = 0.93, False Positive Rate = 3.7%, Detection Latency = 1.21 s and Persistent Attack Detection Rate=88.4%. The statistic analysis results show thatthe hybrid approach composed of statistical, rule-based and temporal pattern analyses implemented with modular streaming architecture has a very higher accuracy and flexibility in detecting stealthy or emerging cyber threats than in traditional real-time networking environment.